"""密钥安全存储单元测试。"""
from unittest.mock import patch

from app import secret_store
from app.secret_store import mask_secret, resolve_secret, store_secret


def test_mask_plaintext():
    assert mask_secret("sk-abcdef123456") == "***3456"
    assert mask_secret("abc") == "••••"
    assert mask_secret("") == ""


def test_mask_keychain_ref():
    assert mask_secret("keychain:yawen-workbench.providers:provider-1") == "•••• 钥匙串保管"


def test_store_without_keychain_returns_plaintext():
    with patch.object(secret_store, "keychain_available", return_value=False):
        result = store_secret("provider-1", "sk-secret")
    assert result == "sk-secret"  # 降级：DB 存明文（旧行为）


def test_store_with_keychain_writes_reference():
    class FakeCompleted:
        returncode = 0
    with patch.object(secret_store, "keychain_available", return_value=True), \
         patch.object(secret_store.subprocess, "run", return_value=FakeCompleted()) as run:
        result = store_secret("provider-1", "sk-secret")
    assert result == "keychain:yawen-workbench.providers:provider-1"
    assert run.call_count == 2  # delete + add


def test_resolve_keychain_reference():
    class FakeCompleted:
        returncode = 0
        stdout = "sk-real-secret\n"
    with patch.object(secret_store, "keychain_available", return_value=True), \
         patch.object(secret_store.subprocess, "run", return_value=FakeCompleted()):
        assert resolve_secret("keychain:yawen-workbench.providers:provider-1",
                              "provider-1") == "sk-real-secret"


def test_resolve_plaintext_passthrough():
    assert resolve_secret("sk-plain", "provider-1") == "sk-plain"
    assert resolve_secret("", "provider-1") == ""